Metric selection for ranking functions from attack surface

Metric selection for ranking functions from attack surface

Kostin M.A. (ISP RAS, Moscow, Russia)
Dovgalyuk P.M. (ISP RAS, Moscow, Russia; NovSU, Veliky Novgorod, Russia)
Fursova N.I. (ISP RAS, Moscow, Russia)
Stepanov V.M. (ISP RAS, Moscow, Russia)

Abstract

When analyzing a large codebase for vulnerabilities, it is often difficult to decide where to start, especially when the project is unfamiliar. To make testing effective, it is necessary to identify potentially vulnerable functions and modules that handle untrusted or sensitive data. The resulting list is called the attack surface. Functions in the attack surface can be a source of vulnerabilities and therefore require special attention. However, not all functions that interact with tainted data are equally interesting for analysis, raising the problem of function ranking. Existing solutions mainly focus on direct vulnerability detection, and most of them relying solely on static analysis. Currently, methods that use simple source code metrics can be more effective than more complex heuristic methods. In this work, we take an existing set of static metrics and extend it with new metrics derived from dynamic analysis. To evaluate the impact of the new metrics, we conducted an experiment on several projects. The results show that the new metrics significantly improve the ranking quality.

Keywords

code metrics; vulnerabilities; dynamic analysis; taint analysis.

Edition

Proceedings of the Institute for System Programming, vol. 38, issue 6, part 2, 2026, pp. 187-198

ISSN 2220-6426 (Online), ISSN 2079-8156 (Print).

DOI: 10.15514/ISPRAS-2026-38(6)-32

For citation

Kostin M.A., Dovgalyuk P.M., Fursova N.I., Stepanov V.M. Metric selection for ranking functions from attack surface. Proceedings of the Institute for System Programming, vol. 38, issue 6, part 2, 2026, pp. 187-198 DOI: 10.15514/ISPRAS-2026-38(6)-32.

Full text of the paper in pdf (in Russian) Back to the contents of the volume